One Flexible Tool Beats a Hundred Dedicated Ones

if you wished an LLM agent to speak to a system at first of 2026 was to put in an MCP server for it.

GitHub. Jira. Slack. Linear. Postgres. Neo4j. Each ships a server that exposes a tidy menu of instruments, create_issue, list_pull_requests, merge_pull_request, get_repository, search_code, and so forth, and also you level your agent at it.

It’s a terrific onboarding expertise. It’s additionally, for a shocking variety of actual workloads, the unsuitable form.

The thesis is brief: MCP design often wraps every service as a pile of devoted instruments; a CLI fingers the agent one actually versatile instrument. With at present’s fashions, the versatile instrument wins.

The 2 shapes ask the mannequin to do totally different work. With a pile of devoted instruments, the agent simply has to choose the precise one off a menu. With a versatile instrument, it has to work out the right way to put the items collectively itself. That second half was the exhausting one. Fashions would hallucinate flags, lose the thread on lengthy pipelines, misinterpret assist textual content, so wrapping each operation in a pre-baked instrument was a wise protection. That simply isn’t true anymore. At present’s fashions learn a --help web page or SKILL.md when they should, know the canonical CLIs from coaching, string collectively bash with out supervision, and retry once they get a flag unsuitable. The exhausting half obtained simple, the straightforward half was all the time simple, and all these neatly-wrapped instruments principally simply bloat the mannequin’s context for nothing now.

After all it’s not all roses and sunshine. Handing the agent a terminal additionally fingers it a a lot greater blast radius. The identical flexibility that lets it compose gh | jq | xargs into one thing helpful additionally lets a immediate injection discuss it into one thing lots worse than a hostile Cypher question. So sure, there’s a trade-off, and it’s a must to truly give it some thought (sandbox, allowlist, separate OS person, read-only function on the database, the same old stuff).

However if you can provide the agent a terminal in a fairly secure approach, the versatile aspect nonetheless comes out forward.

The place CLI shines

The identical “wrap a service as a pile of devoted instruments” sample reveals up wherever MCP does. Postgres MCPs vs. psql. Kubernetes MCPs vs. kubectl. Filesystem MCPs vs. cat, ls, mv, grep glued by pipes. Identical intuition each time, similar CLI counterpart each time. And the identical three failure modes too, as a result of they aren’t actually about anyone product.

Nothing within the MCP spec truly requires this method of piling up devoted instruments. The protocol asks for typed instruments, nothing extra; it says nothing about how slim every instrument must be. Implementations simply gravitate towards many small slim instruments for historic causes. You possibly can construct versatile instruments that take a single expressive enter the agent shapes nonetheless it needs, and more often than not you most likely ought to.

To make it concrete, we’ll take a look at an instance pitting Neo4j MCP server in opposition to Neo4j CLI.

Disclaimer up entrance: I work at Neo4j. The selection is simply comfort, however the learnings apply to most different CLIs.

The Neo4j MCP server is the official server that exposes Neo4j to brokers by MCP, delivery a handful of devoted instruments like learn question, write question, and get schema. neo4j.sh is the official command-line interface for Neo4j, a single binary you run in a terminal with credential profiles for every database you discuss to. To maintain the comparability sincere, we’ll solely take a look at the read-query and schema pair on the MCP aspect in opposition to the equal question invocation in neo4j.sh. Identical operations, similar database, similar Cypher going over the wire. The one factor that adjustments is whether or not the agent reaches them by a typed instrument schema or by a string handed to a shell.

Querying throughout environments

We already noticed how a pile of devoted instruments eats the context window with descriptions, and that some servers now ship deferred instruments to push that value off till the agent truly reaches for them. However there’s a second multiplier no one talks about: what occurs if you need to discuss to multiple occasion of the identical service. With MCP, the instrument depend doesn’t simply develop with options, it grows with environments.

The agent needs a node depend from dev, staging, and prod. Via MCP, you get up a neo4j-mcp-server per setting, each carrying its 4 instrument schemas into the agent’s context on each flip. Three databases is twelve schemas within the mannequin’s window, the identical 4 schemas thrice over, earlier than the agent has completed something.

Via the CLI, it’s a for loop:

$ for c in dev staging prod-ro; do
    neo4j-cli question -c $c --format toon 
      "MATCH (n) RETURN depend(n) AS nodes"
  completed

One binary, three credential profiles, zero per-turn context value. Including a fourth setting is yet one more credential dbms add, not yet one more MCP server course of. The identical form carries over to any “attain out to N related issues” workflow you may want: snapshotting prod earlier than a dangerous deploy, diffing the schema between staging and prod, operating a well being verify throughout each database the agent is aware of about.

Chaining queries

Say the agent is investigating a identified fraud account: from a single seed, discover each account it transacted with, then discover which different accounts these counterparties transact with essentially the most usually. Two queries in opposition to the identical database, the place the second’s parameters are the output of the primary.

Via MCP, the mannequin must be the pipe. It calls read-cypher, the end result comes again as a listing of, say, 80 counterparty IDs, these 80 IDs sit within the mannequin’s context now, the mannequin codecs them into the parameter for the second read-cypher name, and solely then can question two run. The intermediate checklist rides the dialog verbatim, and each additional ID is one other row of context the agent pays for whether or not it ever reads it once more or not.

Via the CLI, the pipe is a literal |:

$ neo4j-cli question -c prod-ro --format json 
    --param "seed=acct_19f3" 
    "MATCH (:Account {id: $seed})-[:TRANSACTED]-(c:Account)
     WHERE c.id <> $seed
     RETURN gather(DISTINCT c.id) AS counterparties" 
  | neo4j-cli question -c prod-ro --params-from-stdin 
      "MATCH (a:Account)-[:TRANSACTED]-(b:Account)
       WHERE a.id IN $counterparties
         AND NOT b.id IN $counterparties + ['acct_19f3']
       RETURN b.id, depend(DISTINCT a) AS edges_into_cluster
       ORDER BY edges_into_cluster DESC LIMIT 20"

--params-from-stdin reads the earlier question’s JSON end result and binds it as a parameter for the following. The counterparties checklist by no means enters the mannequin’s context, the agent’s token value is similar whether or not the cluster has 5 counterparties or 500.

That is the place the shell begins to really feel like a unique class of instrument altogether. The agent isn’t selecting from a menu of operations anymore, it’s composing pipelines, and the intermediate information by no means has to floor. A two-step question turns into a |. A fan-out turns into a for loop. A be a part of throughout two databases turns into one question piped into one other with --params-from-stdin. Every of these can be three or 4 MCP round-trips with each intermediate end result paraded by the context window, and at that time the agent has spent extra tokens shuffling rows than fascinated with them.

Pipe throughout many CLIs

Identical drawback, greater scale. Say the agent needs to materialize a venture’s latest GitHub points into Neo4j: an :Subject node per ticket, a :Consumer node per writer, a :TAGGED relationship per label. The info lives in a single CLI (gh), needs reshaping (jq does that), and lands in one other CLI (neo4j-cli). Three totally different instruments in a single line. Via MCP, you’d hit GitHub’s MCP server for the difficulty checklist, each difficulty physique lands within the mannequin’s context, the mannequin extracts the fields it needs, and write-cypher fires as soon as per difficulty. Tons of of spherical journeys by the mannequin, each difficulty physique sitting within the dialog alongside the best way.

Via the CLI, three packages in a pipe:

$ gh difficulty checklist --repo neo4j/neo4j --limit 100 
    --json quantity,title,writer,labels 
  | jq -c '.[]' 
  | whereas learn difficulty; do
      neo4j-cli question --rw -c prod 
        --param "information=$difficulty" 
        "WITH apoc.convert.fromJsonMap($information) AS i
         MERGE (n:Subject {quantity: i.quantity}) SET n.title = i.title
         MERGE (u:Consumer {login: i.writer.login})
         MERGE (u)-[:OPENED]->(n)
         FOREACH (label IN i.labels |
           MERGE (l:Label {title: label.title})
           MERGE (n)-[:TAGGED]->(l))"
    completed

gh pulls the problems, jq reshapes each right into a single JSON line, the whereas loop fingers every line to neo4j-cli as a Cypher parameter. The mannequin writes this script as soon as after which steps off; the information flows by bash, not by the agent. 100 points or ten thousand, the agent’s token value is similar.

The form generalizes nicely past GitHub. Swap gh for some other CLI that emits JSON (jira difficulty checklist, linear, curl in opposition to a webhook, your individual inner dump command), swap the Cypher sample for no matter database you’re constructing, and the pipeline carries. Two MCP instruments can’t pipe to one another; two CLIs can, and so can ten.

Terminal management is highly effective, and that’s the catch

The terminal isn’t a hard and fast floor, it’s essentially the most versatile instrument you possibly can hand an agent as a result of it composes with every part else on the field.

That energy can be the catch. A versatile instrument used badly does versatile injury. With nice terminal entry comes the apparent accountability: sandbox the shell, allowlist the verbs you truly need, run the agent as a separate OS person, bind credentials to roles that bodily can’t do the damaging factor. None of that is novel, it’s simply sysadmin hygiene utilized to an LLM that varieties quick. And when you can’t do any of that, an MCP server with a small fastened floor continues to be the precise reply; the protocol-level assure that the agent can’t cat ~/.ssh/id_rsa is an actual factor.

The broader level holds even when you keep completely inside MCP. The explanation the terminal wins isn’t that bash is particular, it’s that bash is one instrument with very versatile enter. Pipes, variables, substitution, looping. That’s the form price copying. Learn the terminal as MCP’s restrict case and design towards it: fewer instruments, each accepting expressive enter, the agent doing the composing as an alternative of you anticipating each mixture upfront. Most MCP servers are an extended checklist of slim endpoints as a result of that’s how the underlying API was already formed, not as a result of the agent works higher that approach. The servers that age nicely would be the ones that picked a smaller, extra expressive floor on goal.

All photos on this weblog put up are created by the writer.